fredes Skrevet 3. september 2008 Del Skrevet 3. september 2008 Håper noen har lyst til å ta en titt på loggene mine: Combofix: Klikk for å se/fjerne innholdet nedenfor ComboFix 08-09-01.05 - fredes 2008-09-03 20:54:04.1 - NTFSx86 Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.866 [GMT 2:00] Running from: C:\Users\fredes\Desktop\comfiks.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-08-03 to 2008-09-03 ))))))))))))))))))))))))))))))) . 2008-09-03 20:27 . 2008-09-03 20:27 <DIR> d-------- C:\Users\fredes\AppData\Roaming\SUPERAntiSpyware.com 2008-09-03 20:27 . 2008-09-03 20:27 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com 2008-09-03 20:27 . 2008-09-03 20:27 <DIR> d-------- C:\ProgramData\SUPERAntiSpyware.com 2008-09-03 20:27 . 2008-09-03 20:27 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-09-03 20:23 . 2008-09-03 20:23 <DIR> d-------- C:\Program Files\CCleaner 2008-09-03 20:10 . 2008-09-03 20:10 250 --a------ C:\Windows\gmer.ini 2008-09-03 20:04 . 2008-09-03 20:04 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-30 05:44 . 2008-08-30 05:44 <DIR> d-------- C:\Program Files\FM Modifier 2.2 2008-08-30 02:17 . 2008-08-30 02:17 <DIR> d-------- C:\Users\All Users\Auslogics 2008-08-30 02:17 . 2008-08-30 02:17 <DIR> d-------- C:\ProgramData\Auslogics 2008-08-27 02:02 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll 2008-08-27 02:02 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll 2008-08-27 02:02 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll 2008-08-27 02:02 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll 2008-08-27 02:02 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll 2008-08-27 02:02 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe 2008-08-27 02:02 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll 2008-08-27 02:02 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll 2008-08-27 02:02 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe 2008-08-21 02:36 . 2008-08-21 02:36 <DIR> d-------- C:\Program Files\OrCAD_Demo 2008-08-21 02:35 . 1998-10-29 16:45 306,688 --a------ C:\Windows\IsUninst.exe 2008-08-18 13:00 . 2008-08-18 13:00 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-08-18 12:59 . 2008-08-18 12:59 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdRapi_01_00_00.Wdf 2008-08-18 12:59 . 2008-08-18 12:59 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf 2008-08-13 20:26 . 2008-08-21 04:37 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-08-13 19:07 . 2008-09-03 16:15 <DIR> d-------- C:\Windows\System32\drivers\Avg 2008-08-13 19:07 . 2008-08-13 19:07 <DIR> d-------- C:\Users\All Users\avg8 2008-08-13 19:07 . 2008-08-13 19:07 <DIR> d-------- C:\ProgramData\avg8 2008-08-13 19:07 . 2008-08-13 19:07 <DIR> d-------- C:\Program Files\AVG 2008-08-13 19:07 . 2008-08-13 19:07 97,928 --a------ C:\Windows\System32\drivers\avgldx86.sys 2008-08-13 19:07 . 2008-08-13 19:07 69,128 --a------ C:\Windows\System32\drivers\avgwfpx.sys 2008-08-13 19:07 . 2008-08-13 19:07 12,936 --a------ C:\Windows\System32\drivers\avgrkx86.sys 2008-08-13 19:07 . 2008-08-13 19:07 10,520 --a------ C:\Windows\System32\avgrsstx.dll 2008-08-13 15:37 . 2008-08-13 15:37 <DIR> d-------- C:\Program Files\Dell 2008-08-13 15:37 . 2008-08-13 15:37 7,168 --a------ C:\Windows\DellBIOS.Sys 2008-08-13 15:36 . 2008-09-03 16:17 104,185 --a------ C:\Users\All Users\nvModes.dat 2008-08-13 15:36 . 2008-09-03 16:17 104,185 --a------ C:\ProgramData\nvModes.dat 2008-08-13 15:19 . 2007-09-13 14:45 4,947,968 --a------ C:\Windows\System32\stacgui.cpl 2008-08-13 15:19 . 2007-04-10 17:02 1,601,536 --a------ C:\Windows\System32\stlang.dll 2008-08-13 15:19 . 2007-09-13 14:45 102,400 --a------ C:\Windows\System32\stacsv.exe 2008-08-13 15:18 . 2007-09-13 14:45 595,456 --a------ C:\Windows\System32\stapo.dll 2008-08-13 15:18 . 2007-09-13 14:46 330,240 --a------ C:\Windows\System32\drivers\stwrt.sys 2008-08-13 15:18 . 2007-09-13 14:45 328,704 --a------ C:\Windows\System32\stcplx.dll 2008-08-13 15:18 . 2007-09-13 14:44 299,520 --a------ C:\Windows\System32\stapi32.dll 2008-08-13 15:18 . 2007-09-13 14:45 146,944 --a------ C:\Windows\System32\st325614.dll 2008-08-13 14:52 . 2008-07-16 01:48 2,048 --a------ C:\Windows\System32\tzres.dll 2008-08-13 14:47 . 2008-08-13 14:47 <DIR> d-------- C:\Users\fredes\AppData\Roaming\SystemRequirementsLab 2008-08-13 14:45 . 2008-08-13 14:45 <DIR> d-------- C:\Users\All Users\Apple 2008-08-13 14:45 . 2008-08-13 14:45 <DIR> d-------- C:\ProgramData\Apple 2008-08-13 14:45 . 2008-08-13 14:45 <DIR> d-------- C:\Program Files\Apple Software Update 2008-08-13 10:56 . 2008-06-19 05:25 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL 2008-08-13 10:56 . 2008-06-19 05:25 272,896 --a------ C:\Windows\System32\polstore.dll 2008-08-13 10:56 . 2008-06-19 05:25 61,440 --a------ C:\Windows\System32\winipsec.dll 2008-08-13 10:56 . 2008-06-19 05:25 28,672 --a------ C:\Windows\System32\FwRemoteSvr.dll 2008-08-11 19:31 . 2008-08-11 19:31 <DIR> d-------- C:\Users\All Users\Apple Computer 2008-08-11 19:31 . 2008-08-11 19:31 <DIR> d-------- C:\ProgramData\Apple Computer 2008-08-11 19:31 . 2008-08-11 19:32 <DIR> d-------- C:\Program Files\QuickTime 2008-08-08 16:01 . 2008-08-08 16:01 <DIR> d-------- C:\Program Files\File Scavenger 3.2 2008-08-08 03:57 . 2008-08-08 03:57 <DIR> d-------- C:\Program Files\Ultra Video Splitter 2008-08-08 03:57 . 2007-04-12 14:19 129,024 --a------ C:\Windows\System32\AVERM.dll 2008-08-08 03:57 . 2006-09-26 13:57 28,672 --a------ C:\Windows\System32\AVEQT.dll 2008-08-08 03:53 . 2008-08-08 03:53 <DIR> d-------- C:\Program Files\MPEGSPLITTER 2008-08-08 00:45 . 2008-08-08 00:45 <DIR> d-------- C:\Program Files\mkv2vob 2008-08-08 00:45 . 2008-09-03 20:27 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-03 17:49 --------- d-----w C:\Users\fredes\AppData\Roaming\Azureus 2008-08-30 00:16 2,020 ----a-w C:\Windows\System32\ealregsnapshot1.reg 2008-08-27 20:06 --------- d-----w C:\Program Files\Java 2008-08-20 16:59 --------- d-----w C:\ProgramData\NVIDIA 2008-08-20 16:46 174 --sha-w C:\Program Files\desktop.ini 2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Sidebar 2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Mail 2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Journal 2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Defender 2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Collaboration 2008-08-20 16:33 --------- d-----w C:\Program Files\Windows Calendar 2008-08-20 16:20 79,872 ----a-w C:\Windows\System32\axaltocm.dll 2008-08-20 16:20 101,376 ----a-w C:\Windows\System32\ifxcardm.dll 2008-08-18 11:35 --------- d-----w C:\ProgramData\Logitech 2008-08-13 12:54 --------- d-----w C:\ProgramData\Microsoft Help 2008-08-13 12:47 --------- d-----w C:\Program Files\SystemRequirementsLab 2008-08-01 15:30 --------- d-----w C:\Users\fredes\AppData\Roaming\Pro Cycling Manager 2008 2008-07-29 19:43 --------- d-----w C:\Program Files\TVAnts 2008-07-29 18:44 --------- d-----w C:\Program Files\SopCast 2008-07-29 11:47 130,208 ------r C:\Windows\bwUnin-8.1.1.87-8876480SL.exe 2008-07-23 14:40 304,528 ----a-w C:\Windows\System32\appdrvrem01.exe 2008-07-23 14:40 3,468,904 ----a-w C:\Windows\system32\drivers\appdrv01.sys 2008-07-23 12:43 102,337 ----a-w C:\Users\fredes\AppData\Roaming\nvModes.dat 2008-07-23 12:40 --------- d-----w C:\Program Files\Cyanide 2008-07-21 18:58 --------- d-----w C:\Users\fredes\AppData\Roaming\Auslogics 2008-07-21 18:50 --------- d-----w C:\Program Files\Auslogics 2008-07-21 18:44 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-07-08 21:50 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf 2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll 2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll 2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll 2008-06-18 14:33 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll 2008-06-12 06:54 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll 2008-06-12 06:54 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-06-12 01:21 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "i8kfangui"="C:\Program Files\I8kfanGUI\I8kfanGUI.exe" [2007-02-16 856064] "VistaBatterySaver"="C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe" [2007-08-24 479232] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-11-17 171464] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 125440] "Google Update"="C:\Users\fredes\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-09-02 133104] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-08-19 1576176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2007-01-25 159744] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-05-08 174872] "IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-05-08 33048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "Windows Mobile-based device management"="C:\Windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-13 1235736] "SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-13 405504] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2008-02-22 166432] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-02-22 13515296] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-02-22 92704] "NVHotkey"="C:\Windows\system32\nvHotkey.dll" [2008-02-22 92704] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-06-12 C:\Windows\KHALMNPR.Exe] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-07-29 91440] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-11-07 768528] QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe [2008-02-22 1193240] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "DisableStartupSound"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{5307386B-A21A-4DBE-939F-F65A8684FF90}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{B1D3033E-250B-436D-A46C-6B32FA9AFB7D}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{B27ED313-19C7-4459-94FC-D032CA233BE4}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{2159F5F8-17CC-4CF0-BB38-22D8D8CCFF8D}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{2ED20B1F-B76C-45AC-B006-729D8B197DA2}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{7064CFF7-F8D1-45A0-BB2A-9A60DB8D847E}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{8372A183-76D3-468E-8FE6-8D3075AB99A0}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{6F464896-4455-49AD-B98E-E7A9DD75CD0D}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "TCP Query User{761F11A7-F606-4FA2-B989-92E920692C7D}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{1B160DAC-4DB1-44A0-8C21-314BA7C5C17F}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "TCP Query User{F5AD415F-D03F-43DC-B2D0-BA0C1BB87FAA}C:\\program files\\maple 11\\jre\\bin\\maple.exe"= UDP:C:\program files\maple 11\jre\bin\maple.exe:Maple 11 "UDP Query User{99A38D68-D50F-4C22-8229-E377768CAB02}C:\\program files\\maple 11\\jre\\bin\\maple.exe"= TCP:C:\program files\maple 11\jre\bin\maple.exe:Maple 11 "TCP Query User{324E482C-C3C3-4BCF-A24E-7601854A8908}C:\\program files\\maple 11\\jre\\bin\\maple.exe"= UDP:C:\program files\maple 11\jre\bin\maple.exe:Maple 11 "UDP Query User{546F13CB-F8F9-4C15-BDAA-2FFC859B1111}C:\\program files\\maple 11\\jre\\bin\\maple.exe"= TCP:C:\program files\maple 11\jre\bin\maple.exe:Maple 11 "TCP Query User{A2E4D9C9-DD6F-49B9-895E-E0E5625575AD}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus "UDP Query User{AEB5B9E8-C3E1-438A-835A-470EE7189DE7}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus "TCP Query User{16BFB7CA-3117-4718-88B6-2453C33373CE}C:\\program files\\electronic arts\\eadm\\core.exe"= UDP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager "UDP Query User{280DB631-2593-40C9-B8C8-274EC8F52382}C:\\program files\\electronic arts\\eadm\\core.exe"= TCP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager "TCP Query User{69145179-F4CF-4680-8989-A564878AE815}C:\\program files\\electronic arts\\eadm\\core.exe"= UDP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager "UDP Query User{68E60955-460E-4810-B92B-29EDDB660D8A}C:\\program files\\electronic arts\\eadm\\core.exe"= TCP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager "{1B959C40-8266-444D-9D56-1609FA8E61C5}"= UDP:C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "{4D384DF6-FE84-4443-A5D9-AB340D6E82D8}"= TCP:C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "TCP Query User{F41D5C44-737B-4B2F-95CB-41E3AB2A902E}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus "UDP Query User{722D573A-40D3-451F-A328-9A7D4FD26AE5}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus "{BB9D7157-A943-4AA8-9A89-CF81B6B4B8D9}"= UDP:C:\Program Files\Cyanide\GameCenter\GameCenter.exe:GameCenter "{5633D6D0-C3CB-425B-8875-92FD90946531}"= TCP:C:\Program Files\Cyanide\GameCenter\GameCenter.exe:GameCenter "{A21DB39B-0084-4D77-AF00-68B9A8DD2616}"= UDP:C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\PCM.exe:Pro Cycling Manager - Season 2008 "{432A7A94-4567-48D0-8ED7-8E3CC1E059AD}"= TCP:C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\PCM.exe:Pro Cycling Manager - Season 2008 "{6F456F5F-F3B3-49BF-83C8-F6FF52B0BC22}"= UDP:C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\Autorun\Exe\Autorun.exe:Pro Cycling Manager - Season 2008 - AutoRun "{F31CFFB7-3D4E-4FCF-85B0-F9BC6DFD168D}"= TCP:C:\Program Files\Cyanide\Pro Cycling Manager - Season 2008\Autorun\Exe\Autorun.exe:Pro Cycling Manager - Season 2008 - AutoRun "{4FF2E2E2-A5E2-47DD-A758-1CA5532C9B2C}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger "{C3CFCC17-3420-4A72-8107-0C06F104192B}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger "{B95F92B5-C133-4C83-9987-A278502ECEB9}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger "{FCA561F1-A109-4760-A7D8-03FDD3EB2074}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger "{34123567-46A2-478A-9D15-4896CFFAE756}"= UDP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger "{A08F6E51-977C-4328-BE57-92C2C3011F4A}"= TCP:C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:Logitech Desktop Messenger "TCP Query User{B3CBD5BD-CF82-45D2-B107-B35C68C30315}C:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver "UDP Query User{9C31BBA2-E328-4390-BB94-50F35B656F6F}C:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:C:\program files\sopcast\adv\sopadver.exe:SopCast Adver "TCP Query User{A1FC7604-C7F7-4A8A-B944-6BEEFD282C8D}C:\\program files\\sopcast\\sopcast.exe"= UDP:C:\program files\sopcast\sopcast.exe:SopCast Main Application "UDP Query User{98DD25E4-2E71-4FFA-A4F7-BB38E0B5C998}C:\\program files\\sopcast\\sopcast.exe"= TCP:C:\program files\sopcast\sopcast.exe:SopCast Main Application "TCP Query User{4F8F5CD5-4CF0-447D-921F-44B2382F26F6}C:\\program files\\tvants\\tvants.exe"= UDP:C:\program files\tvants\tvants.exe:TVAnts "UDP Query User{7296E19E-1A3B-450B-9635-DF8D998A73D3}C:\\program files\\tvants\\tvants.exe"= TCP:C:\program files\tvants\tvants.exe:TVAnts "TCP Query User{E2D4397E-250F-4F0A-BED2-1A141AFA79FB}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{F93BDC11-9B39-4CD0-85CE-480ECFFE7A57}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "{CE31D885-1C5B-400C-BD7D-594740B96DD0}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe "{4B9C5C2D-82C8-471E-9F0D-314913A079DB}"= C:\Program Files\AVG\AVG8\avgnsx.exe:avgnsx.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| R0 AvgRkx86;avgrkx86.sys;C:\Windows\system32\Drivers\avgrkx86.sys [2008-08-13 12936] R0 iaNvStor;Intel® Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [2007-05-04 208896] R1 appdrv01;Application Driver (01);C:\Windows\system32\Drivers\appdrv01.sys [2008-07-23 3468904] R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-08-13 97928] R1 fanio;FanIO driver;C:\Windows\system32\drivers\fanio.sys [2007-02-16 14464] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-13 231704] R2 BthFilterHelper;Bluetooth Feature Support;C:\Program Files\CSR\Vista Profile Pack\BthFilterHelper.exe [2006-11-07 127488] R3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-08-13 69128] S0 OemBiosDevice;Royalty OEM BIOS Extension;C:\Windows\system32\DRIVERS\royal.sys [2007-05-26 240128] S2 appdrvrem01;Application Driver Auto Removal Service (01);C:\Windows\System32\appdrvrem01.exe svc [ ] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 179712] S3 cmeu0wdm;CardMan 2020;C:\Windows\system32\DRIVERS\cmeu0wdm.sys [2005-05-23 43737] S3 DellBIOS;DellBIOS;C:\Windows\DellBIOS.Sys [2008-08-13 7168] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \shell\AutoRun\command - E:\AllwaySync'n'Go.exe -autorun [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \shell\AutoRun\command - G:\AllwaySync'n'Go.exe -autorun [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e4b7af7-9797-11dc-bf20-b322a69a4400}] \shell\AutoRun\command - F:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74fa5581-5758-11dd-8960-8b2c35172df0}] \shell\AutoRun\command - E:\Launcher.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c8cbfea-7d01-11dc-ac06-001a6bc4f626}] \shell\AutoRun\command - G:\AllwaySync'n'Go.exe -autorun *Newly Created Service* - CATCHME *Newly Created Service* - GMER *Newly Created Service* - PROCEXP90 *Newly Created Service* - SASDIFSV *Newly Created Service* - SASENUM *Newly Created Service* - SASKUTIL . Contents of the 'Scheduled Tasks' folder . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Users\fredes\AppData\Roaming\Mozilla\Firefox\Profiles\tkw4xg0m.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://go.microsoft.com/fwlink/?LinkId=69157 FireFox -: user.js - STARTUP.HOMEPAGE - hxxp://go.microsoft.com/fwlink/?LinkId=69157 FF -: plugin - c:\Program Files\Microsoft Silverlight\2.0.30226.2\npctrl.dll FF -: plugin - c:\Program Files\Microsoft Silverlight\2.0.30523.8\npctrl.1.0.30109.0.dll FF -: plugin - c:\Program Files\Microsoft Silverlight\2.0.30523.8\npctrl.dll FF -: plugin - C:\Users\fredes\AppData\Local\Google\Update\1.2.131.11\npGoogleOneClick5.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-03 20:56:34 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-09-03 20:57:45 ComboFix-quarantined-files.txt 2008-09-03 18:57:42 Pre-Run: 52,436,328,448 bytes free Post-Run: 52,398,436,352 bytes free 267 --- E O F --- 2008-09-02 23:43:57 Hijackthis: Klikk for å se/fjerne innholdet nedenfor Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:59:50, on 03.09.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16711) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Windows\WindowsMobile\wmdSync.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe C:\Program Files\Apoint\ApMsgFwd.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\I8kfanGUI\I8kfanGUI.exe C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Windows\System32\rundll32.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE C:\Users\fredes\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\fredes\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\fredes\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\fredes\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\fredes\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\conime.exe C:\Windows\Explorer.exe C:\Users\fredes\Desktop\drops.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemonsearch.com/no/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [iaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [sigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [i8kfangui] C:\Program Files\I8kfanGUI\I8kfanGUI.exe /startup O4 - HKCU\..\Run: [VistaBatterySaver] C:\Program Files\SharpSoft\Vista Battery Saver\VistaBatterySaver.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Google Update] "C:\Users\fredes\AppData\Local\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\Windows\System32\appdrvrem01.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bluetooth Feature Support (BthFilterHelper) - CSR, plc - C:\Program Files\CSR\Vista Profile Pack\BthFilterHelper.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe O23 - Service: Dell Internal Network Card Power Management (nicconfigsvc) - Dell Inc. - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe -- End of file - 8432 bytes SAS: Klikk for å se/fjerne innholdet nedenfor SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 09/03/2008 at 08:52 PM Application Version : 4.20.1046 Core Rules Database Version : 3556 Trace Rules Database Version: 1544 Scan type : Quick Scan Total Scan Time : 00:16:00 Memory items scanned : 587 Memory threats detected : 0 Registry items scanned : 480 Registry threats detected : 0 File items scanned : 17550 File threats detected : 0 Lenke til kommentar
norbat Skrevet 3. september 2008 Del Skrevet 3. september 2008 Ser fint ut dette. Var det bare en sjekk eller er det noe som skulle tilsi at du er infisert med noe? Lenke til kommentar
fredes Skrevet 3. september 2008 Forfatter Del Skrevet 3. september 2008 (endret) Glemte å slenge med resultatet av AVG Anti-rootkit, som forteller at følgende er funnet: Hidden driver C:\Windows\System32\Drivers\adhdt2i8.SYS Det popper forøvrig opp etter 1 sekund med scanning. Endret 3. september 2008 av fredes Lenke til kommentar
norbat Skrevet 3. september 2008 Del Skrevet 3. september 2008 Når du sier AVG Anti-rootkit, så mener du AVG8 (der rootkit-programmer er integrert)? Loggene du har postet tilsier at du ikke har noen rootkit liggende (combofix kjører også en rootkitsjekk - gmer). Er det slik at AVG sier at det er en rootkit eller får du noen annen info om fila? Lenke til kommentar
fredes Skrevet 3. september 2008 Forfatter Del Skrevet 3. september 2008 (endret) Stemmer at det er AVG8s integrerte rootkitscanner. Får ingen info om fila, annet enn at det er en "Hidden driver". I tillegg står det Rootkits count : 0/1 Hvis jeg ber AVG om å fjerne infeksjonen dukker det bare opp ei ny, lignende, fil etter reboot. Nå er det for eksempel ap09lm78.SYS som gjelder Endret 3. september 2008 av fredes Lenke til kommentar
norbat Skrevet 3. september 2008 Del Skrevet 3. september 2008 Slike filer kan like godt være knyttet til et av sikkerhetsprogrammene du bruker inkl. brannmur. Du kunne ha kjørt en scan med Blacklight (rootkitskanner) og sett om den finner noe tilsvarende. Lenke til kommentar
fredes Skrevet 3. september 2008 Forfatter Del Skrevet 3. september 2008 Blacklight fant ingenting. Satser på at det ikke er noe å bekymre seg over. Takk for hjelpen Lenke til kommentar
Anbefalte innlegg
Opprett en konto eller logg inn for å kommentere
Du må være et medlem for å kunne skrive en kommentar
Opprett konto
Det er enkelt å melde seg inn for å starte en ny konto!
Start en kontoLogg inn
Har du allerede en konto? Logg inn her.
Logg inn nå